The Diamond Model of Intrusion Analysis: how threat intelligence works in practice

Every cyberattack, whether a phishing email or a ransomware deployment, follows a specific structure. This structure includes an adversary, a capability, the infrastructure needed to carry out the attack, and a victim. The Diamond Model of Intrusion Analysis can help understand what happened during an attack.

The Diamond Model shows how all the pieces of an attack fit together. It helps answer questions like who did it, how they did it, what tools they used, and who or what was affected. It is different from MITRE ATT&CK, which focuses on the attack tactics and techniques, or the Cyber Kill Chain, which outlines the attack sequence. How? In short, the Diamond Model lets security teams connect the dots between the 4 elements of an attack.

In this article, we break down the Diamond Model of Intrusion Analysis and explain why it is a key part of threat intelligence.

Key takeaways

• The Diamond Model of Intrusion Analysis breaks a cyberattack into 4 connected parts: the adversary, the capability, the infrastructure, and the victim.
• The model helps with the analysis of what happened during an attack, who was responsible, how it was carried out, and what infrastructure was used.
• Unlike the Cyber Kill Chain or MITRE ATT&CK, the Diamond Model focuses on the relationships between the attack elements, which enables it to spot patterns across multiple incidents.
• Some analysts claim that the Diamond Model may oversimplify intrusion analysis in some cases.
• The model is a very useful threat intelligence tool for businesses to prioritize defenses, guide security spending, and speed up incident response.

What is the Diamond Model of Intrusion Analysis?

The Diamond Model of Intrusion Analysis helps security analysts understand cyberattacks. It breaks down an intrusion into 4 core components and shows how they relate to one another.

A cybersecurity researcher and author, Chris Sanders, said that intrusion analysis is as much about tcpdump as astronomy is about telescopes. In other words, an attack analysis shouldn’t be narrowed down to one element. Only by analyzing all 4 elements together can the complete picture of the attack be seen.

In a 2013 technical report for the US Department of Defense, Sergio Caltagirone, Andrew Pendergast, and Christopher Betz introduced the Diamond Model. They developed the model to make intrusion analysis easier and more complete. Since then, the model has been incorporated into cybersecurity courses and certification programs, such as CompTIA Security+, CySA+, and the EC-Council’s Certified Ethical Hacker (CEH).

How does the model work? It explains every cyber intrusion by looking at the 4 interconnected elements shown in a diamond-shaped diagram. Security teams use the model to answer the following questions about every attack:

1. Who is the adversary?
2. What capabilities, such as tools, methods, and skills, did they use?
3. What infrastructure supported the attack?
4. Who or what was the victim?

4 key elements of the Diamond Model of Intrusion Analysis

The adversary: who is behind the attack?

The adversary is the person or group responsible for the attack. When you start an analysis, you might not know exactly who they are. The Diamond Model helps you analyze the following:

• The threat actor’s identity, name, or pseudonym
• Entities sponsoring or endorsing the attackers
• Their geographical origin
• Their motivations, such as financial gain, espionage, disruption, or hacktivism
• Any indicators that link them to past attacks

The capability: what tools and techniques do attackers use?

This element gives you insights into the attackers’ skills, tools, malware, and level of sophistication. It allows you to analyze how an adversary prepares for, carries out, and delivers an intrusion. Key capabilities may include:

• Reconnaissance techniques used to identify targets and weaknesses
• Methods used to deliver phishing emails, malware, or other payloads
• Skills for exploiting known or unknown vulnerabilities
• Malware and backdoor deployment (how skilled they are at carrying out remote-controlled attacks)
• Tool development and refinement abilities

Attackers often reuse these capabilities across multiple campaigns. The same malware, exploit, or phishing template can help analysts connect separate incidents to the same adversary.

The infrastructure: what systems does the attacker use to carry out the attack?

Infrastructure is the technical foundation that an adversary relies on to carry out an intrusion. This covers:

• Command-and-control (C2) domains (what domain names are used)
• C2 server locations
• C2 server types
• C2 mechanisms and structure
• Compromised systems
• Paths of data leakage

Like capabilities, infrastructure is often reused across multiple attacks. Cybercriminals often stick to the same C2 domain for months or years, or rotate through a small set of compromised servers. When you identify the infrastructure they used in an attack, you can search for other incidents involving it—and those incidents often connect to the same adversary or campaign.

The victim: who or what is being targeted?

A victim is the target of an attack, whether it’s an organization, system, person, or data. Identifying the victim is useful because it shows:

• Which industries or sectors are currently at risk
• Whether attacks are highly targeted or launched at many targets
• The attacker’s actual motive (for example, a nation-state targeting government agencies looks different from a cybercriminal targeting banks)
• Potential future targets (patterns in victim selection suggest where attacks might strike next)

If analysts see the same type of organization being targeted across multiple incidents by different actors using different tools, it signals that the industry is facing an active threat.

How the 4 elements of the Diamond Model connect

The 4 elements of the model have different relationships with each other. Here are the ones that matter most in practice:

• Capability ↔ infrastructure. Uncovers how tools are deployed and hosted, and how they communicate with the infrastructure.
• Adversary ↔ infrastructure. Reveals the technical resources that the threat actor controls, acquires, or sets up.
• Adversary ↔ capability. Shows how a cybercriminal owns, builds, or trains with attack tools and techniques.
• Infrastructure ↔ victim. Shows which victims are reached through which infrastructure. For example, it shows whether victims are reached through phishing emails from a specific sender domain or exploit traffic from a specific IP range.
• Adversary ↔ victim. This is about the attackers’ intent or motivation. Helps see who the target is and why.
• Capability ↔ victim. Explains how specific tools affect specific targets.

This way of thinking becomes clear when you analyze an intrusion. If you have 3 of the 4 pieces, you can often identify the last one. Here is how it works in practice:

• Say you find a malicious domain (infrastructure) used in previous attacks. You identify a malware family or technique linked to those attacks (known capability), and see that the targets are all healthcare organizations (known victims). Now, you can narrow down which threat actors are likely to be responsible.
• In another case, you identify a specific backdoor (capability) communicating with a C2 server (infrastructure) previously linked to an organized cyber gang (known adversary). The affected systems are in the financial services industry (identifying the victim). This tells you that the gang is active in the financial services industry and is still using that backdoor.

Meta-features: the context behind each attack event

The Diamond Model goes deeper than just the 4 core elements. It also captures meta-features, which provide additional context about each attack:

• Timestamp. Specifies exactly when the attack happened. Recognizing that a threat group always attacks during specific business hours or in specific time zones can help your team prepare.
• Phase. Answers the question of which stage of the attack lifecycle the event represents. For example, is it reconnaissance, weaponization, or delivery, for example? It connects the Diamond Model to sequential frameworks like the Cyber Kill Chain.
• Result. This is about the outcome of the intrusion. Did it succeed or fail? Or maybe it was only partially successful. Tracking successes vs. failures shows which techniques are the most effective.
• Direction. Allows analysts to determine the path of the attack, such as whether it was adversary-to-victim or victim-to-adversary.
• Methodology. Enables understanding of how the adversary executed the attack, whether by phishing, a watering hole attack, or a supply chain compromise.
• Resources. Focuses on the external assets that the attacker needed to execute the attack, such as financial funds, legal entities, and hardware.

These meta-features turn a single security alert into something analysts can use to compare dozens of incidents, revealing patterns in how specific threat actors operate.

Mapping an activity thread: the socio-political and technological axis

An activity thread connects several Diamond Model events across different stages of an attack. By placing these events in order, analysts can see how an intrusion develops over time and how one event leads to the next.

The extended Diamond Model can add more context to that thread. For example, the socio-political axis can help analyze why the adversary is attacking, and the technology axis can show the tools, infrastructure, and techniques used during the attack.

• Start by defining the attacker’s socio-political goal. For example, an organized cybercrime group may target aviation companies to steal intellectual property. This motive usually remains the same throughout the campaign.
• Next, arrange each event by timestamp and attack phase. This shows how the operation progressed from the initial access stage to the later stages.
• Track changes in capabilities and infrastructure from phase to phase. A phishing phase may use a malicious macro document, while a later phase may rely on an executable payload and different command-and-control servers.
• Connect separate events. The same malware, IP address, domain, or attack method may indicate that several incidents belong to the same campaign.

Here is an example of how it works:

The Diamond Model of Intrusion Analysis vs. other cybersecurity frameworks

The Diamond Model does not replace other threat intelligence frameworks; rather, it complements them. Each framework examines cyberattacks from a different angle, so security teams often use several together.